CORS in OAuth: Response to preflight request doesn't pass access control check

So I'm trying to implement the OAuth 2 flow, while my webapp is the server that give away authorization code/access token.

Cors error happens when sending the code back to third-party website(zapier in this case):

XMLHttpRequest cannot load https://zapier.com/dashboard/auth/oauth/return/App505CLIAPI/?code=somecode&state=somestate. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://myurl' is therefore not allowed access.

If I manually open a new tab, paste that zapier uri, everything works perfectly.

Seems like a typical CORS issue, but none the popular solutions works for me:

1. Add Access-Control-Allow-Origin: I'm using this oauth2orize library, and sending reponse to preflight seems also part of the library. So I cannot add header.
2. Using cors: Have tried app.use(cors()) and app.options('*', cors()) which should apply to all routes, but simply not working.

My webapp sits on a node express server, in front of which there's an nginx proxy server.

Any idea where the problem might be is welcome.

via Stanley Luo